Low: bzip2

Issue Overview: BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 Affected Packages: bzip2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Medium: microcode_ctl

Issue Overview: A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the ability to execute AVX instructions can gather the AVX register state from previous AVX executions. This vulnerability allows information disclosure of the AV...

Medium: libxml2

Issue Overview: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. CVE-2020-24977 There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to...

Amazon Linux 2 : golang (ALAS-2021-1657)

The version of golang installed on the remote host is prior to 1.15.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1657 advisory. A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and...

Important: glib2

Issue Overview: An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. CVE-2021-27219 Affected...

Amazon Linux 2 : nss (ALAS-2021-1664)

The version of nss installed on the remote host is prior to 3.53.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1664 advisory. A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple...

Amazon Linux 2 : libX11 (ALAS-2021-1661)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1661 advisory. A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client...

Amazon Linux 2 : curl (ALAS-2021-1653)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Refere...

Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Medium: nss

Issue Overview: A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system...

Low: samba

Issue Overview: No CVE associated with this advisory Affected Packages: samba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update samba or yum update...

Medium: python-urllib3

Issue Overview: A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to...

Amazon Linux 2 : slapi-nis (ALAS-2021-1646)

The version of slapi-nis installed on the remote host is prior to 0.56.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1646 advisory. A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated...

Amazon Linux 2 : qemu (ALAS-2021-1671)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1671 advisory. A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of- bounds read access and...

Amazon Linux 2 : glibc (ALAS-2021-1656)

The version of glibc installed on the remote host is prior to 2.26-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1656 advisory. In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap- based buffer over-read...

Amazon Linux 2 : python-lxml (ALAS-2021-1666)

The version of python-lxml installed on the remote host is prior to 3.2.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1666 advisory. A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly...

Amazon Linux 2 : wpa_supplicant (ALAS-2021-1648)

The version of wpasupplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1648 advisory. In p2pcopyclientinfo of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remot...

Amazon Linux 2 : lldpad (ALAS-2021-1637)

The version of lldpad installed on the remote host is prior to 1.0.1-5.git036e314. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1637 advisory. lldptool can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Amazon Linux 2 : python-pip (ALAS-2021-1639)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1639 advisory. The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting...

Amazon Linux 2 : spamassassin (ALAS-2021-1642)

The version of spamassassin installed on the remote host is prior to 3.4.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1642 advisory. A flaw was found in spamassassin. Malicious rule configuration .cf files can be configured to run system commands without any...